Named Credentials OAuth Token Error with External Credentials and Custom Headers

This article explains two ways to resolve the OAuth token fetch error that occurs when an external service's token endpoint requires custom headers that Named Credentials does not pass.

Option A: Implement a Custom Solution Using Apex

This approach lets you include the necessary custom headers in the token request and any subsequent API calls directly in Apex, ensuring the external endpoint's requirements are met.

Step 1: Create a Custom Apex Class

• Go to Salesforce Setup.
• Navigate to 'Apex Classes' and click 'New'.
• Create a new Apex class to handle the API callout.

The following is an example code snippet. Use or modify it based on your scenario. It sends a POST request to the token endpoint, sets the required `Content-Type` and `apiKey` headers, and passes the client ID and client secret in the request body:

`public class CustomApiCallout {
    public static HttpResponse makeCallout() {
        HttpRequest req = new HttpRequest();
        req.setEndpoint('https://your-external-endpoint.com/token');
        req.setMethod('POST');

        // Set custom headers
        req.setHeader('Content-Type', 'application/json');
        req.setHeader('apiKey', 'YOUR_API_KEY');

        // Set the body of the request
        req.setBody('{"client_id":"YOUR_CLIENT_ID","client_secret":"YOUR_CLIENT_SECRET"}');

        Http http = new Http();
        HttpResponse res = http.send(req);

        if (res.getStatusCode() == 200) {
            // Process the response
            return res;
        } else {
            // Handle the error
            throw new CalloutException('Failed to get OAuth token: ' + res.getStatus());
        }
    }
}`

Step 2: Invoke the Custom Apex Class

You can invoke the class method above from other Apex classes or triggers as needed. For example:

`HttpResponse response = CustomApiCallout.makeCallout();
System.debug(response.getBody());`

This calls the custom callout method and logs the response body for verification.

Step 3: Secure Your Credentials

Store sensitive information such as the client ID and client secret securely, using Salesforce's protected custom settings rather than hardcoding them in Apex.

Step 4: Test the Configuration

Ensure you have appropriate test classes to handle the API callout in a test environment before deploying to production.

Option B: Use a Proxy Service

Create a middleware endpoint that adds the required headers before forwarding requests to the token endpoint. This keeps the header-injection logic outside Salesforce entirely, which can be useful if you'd rather not maintain custom Apex for this.